# Pages with a broken canonical

A per-URL report: one row per page that matches, over the pages a crawl reached.

## What this report returns

A canonical URL tells crawlers and AI agents which URL is the master copy of a page, so duplicate versions consolidate instead of competing.

A row appears here when any of these is wrong, worst first:

-   **Outside Head**This canonical <link> sits outside the <head>, where Google and most consumers ignore it, so the declaration has no effect.**Fix** Move the <link `rel="canonical"`> tag into the document <head>.
-   **Conflicting**The page declares more than one distinct canonical target (head tag vs Link header, or duplicate tags), so no single canonical wins and consumers may ignore them all.**Fix** Keep exactly one declaration pointing at one absolute URL; remove or align the extras.
-   **Empty Href**The canonical link's href is empty, so no canonical is actually declared and consumers fall back to guessing.**Fix** Set href to the page's full preferred URL, e.g. `href="https://www.example.com/page"`.
-   **Invalid URL**The canonical target isn't a usable http(s) URL (e.g. mailto:, data:, or malformed), so agents can't fetch the canonical resource.**Fix** Point the canonical at the page's full https URL.
-   **Insecure URL**This https page names a plain http:// canonical, so agents and crawlers that follow it are sent to the unencrypted copy, where content can be altered in transit. A Lumar bar: RFC 6596 allows it.**Fix** Point the canonical at the https URL, e.g. `https://example.com/page`.

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

## The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

-   Canonical Valid`canonicalValid`
-   Canonical Security Risk Detected`canonicalSecurityRiskDetected`
-   Canonical Findings`canonicalFindings`
-   Canonical URLs Resolved`canonicalResolvedTargets`
-   Canonical URLs as Written`canonicalHrefs`
-   Canonical Declared In`canonicalSources`
-   Canonical Outside Head`canonicalOutsideHead`
-   Canonical Conflicting`canonicalConflicting`
-   Canonical Empty Href`canonicalEmptyHref`
-   Canonical Invalid URL`canonicalInvalidUrl`
-   Canonical Insecure URL`canonicalInsecureUrl`
-   Canonical Relative`canonicalRelative`
-   Canonical Cross-Origin`canonicalCrossOrigin`
-   Ruleset Version`rulesetVersion`
-   Security Check Status`securityCheckStatus`
-   Related Security Frameworks`securityFrameworkReferences`

## About Canonical URL

Tells an agent which address is the real one for this page.

[Read how Canonical URL is checked](https://agentic-readiness.lumar.io/docs/discoverability/canonical), including the specification it is validated against and a worked correct and broken example.

## Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account.

[Get Lumar pricing →](https://www.lumar.io/pricing/)